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In various types of electronic transactions, including election systems and 
digital cash schemes, user anonymity and authentication are always required. 
Blind signatures are considered the most important solutions to meeting these 
requirements. Many studies have focused on blind signature schemes; 
however, most of the studied schemes are single blind signature schemes. 
Although blind multi-signature schemes are available, few studies have 
focused on these schemes. In this article, blind multi-signature schemes are 
proposed based on the Elliptic Curve Discrete Logarithm Problem (ECDLP). 
The proposed schemes are based on the GOST R34.10-2012 digital signature 
standard and the EC-Schnorr digital signature scheme, and they satisfy blind 
multi-signature security requirements and have better computational 
performance than previously proposed schemes. The proposed schemes can 


be applied in election systems and digital cash schemes. 


Random oracle model (ROM) 
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1. INTRODUCTION 

David Chaum first proposed the idea of blind signatures based on the RSA signature scheme in 1983 
[1]. Subsequently, a number of research studies on blind signatures was completed to protect the anonymity 
of users and prevent fake online transactions. 

In recent decades, elliptic curves have emerged as important factors in digital and crypto theory. The 
security level of cryptography systems is based on elliptic curve cryptography (ECC) and the difficulty of 
elliptic curve discrete logarithm problems (ECDLPs). The advantages of ECC cryptosystems compared with 
other public-key cryptography systems is that ECC ciphers provide security attributes comparable to 
traditional public-key cryptography systems despite their smaller key lengths. Reports have estimated that the 
3248-bit length in the RSA cryptosystem has the same security level as the 256-bit length of the ECC 
cryptosystem. Thus, the installation of ECC consumes less system resources and energy and provides a 
higher level of security. Because of the advantage of small key length, ECC has been widely applied in many 
fields. 

Digital signatures based on the difficulty of ECDLPs were first introduced in 1991 in the 
independent research of NealsKoblitz [2]. Since the 2000s, the USA, Russia, Japan, Korea and several 
European countries have investigated these problems and have developed standard system solutions, such as 
the standards by ISO, ANSI, IEEE, SECG, and FIPS. ECDLP is the predominant cryptosystem in Russia. In 
2001, Russia produced the GOST R34.10-2001 digital signature standard based on ECDLP with a 256-bit 
key length. The newest Russia version of the digital signature is GOST R34.10-2012 [3], which has a key 
length between 256 bits and 512 bits. 
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Blind multi-signatures (BMSs) are signatures in which the signer does not know what they are 
signing, thus the term “blind”. Such signatures are possible because the content of the message M has been 
“blinded” to become M' before the message is provided to the collective to sign. Thus, the signing collective 
signed M’ and not M. Specifically the user U needs the collective S to sign message M; however, U does not 
provide S with M but rather blinds M to M' and then provides the blinded M’ to S to sign. After receiving the 
signed M’, U unblinds the message to obtain the signature for M. Therefore, U has a signature for M without 
providing S with information on M. Blind multi-signatures have many practical applications, such as 
anonymous access control or anonymous multi-sided authorization. Figure 1 show the blind Multi-Signature 
Process. 


SIGNERS 


MESSAGE 


UNBLIND 
SIGNATURE 


MESSAGE VERIFICATION 


TRUE/ FALSE 


Figure 1. Blind Multi-Signature Process 


In 1999, Popescu [4] presented blind multi-signatures based on elliptic curves. In 2005, Chow et al. 
proposed two blind signature schemes partially based on Bilinear Pairings [5]. In 2011, Moldovyan [6] 
presented a blind signature scheme based on the GOST R34.10-2001 signature standard. In 2012, Nguyen 
and Dang [7] provided enhanced security for voting protocols on the Internet using blind signatures; Swati 
Verma et al. also presented New Proxy Blind Multi Signature based on Integer Factorization and Discrete- 
Logarithm Problems [8]. In 2013, Panda et al. researched blind signing authorizations in electronic voting 
processes [9]. In 2014, Hua Sun et al. proposed New Certificateless Blind Ring Signature Scheme [10]. In 
2016, Shilbayeh et al. proposed security schemes for electronic voting processes [11]. In 2017, Minh H et al. 
New Blind Signature Protocols based on a New Hard Problem [12]; Salome James et al. proposed Identity- 
Based Blind Signature Scheme with Message Recovery [13]. 

In the next section, details on the ECDLP will be presented, the blind multi-signature schemes based 
on digital signature standards will be proposed, security through the Random Oracle Model (ROM) will be 
demonstrated and a comparison between the proposed schemes and available schemes will be performed. 


2. BACKGROUND 
The following notations are used: 
Z: set of all integers 
p: prime number, p> 3 
a, b: elliptic curve coefficients 
m: points of the elliptic curve group order 
q: subgroup order of group of points of the elliptic curve 
O: zero point of the elliptic curve 
P: elliptic curve point of order q 
d: integer - a signature key 
G: elliptic curve point - a verification key 
An elliptic curve with the following form is studied in this work: 


y =x +ax+bmod p. 


(1) 
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where a and b are constants, the values of x, y, a, b are in the fields GF(p) and 
4a’ +27b* + Omod p. 
In addition, J(E) can be used to calculate E as follows: 


J(E) =1728 
(E) 3 


4a’ 
a> +27b? ge 


The constants a and b can be determined by J(E) as follows: 


a= 2k(mod p);b= 3k(mod p). 


where k = 


J(E) 


= ————— mod p; J (E) #0; J/(£) 41728. 
mein TAA 


Definition 1 (BMS): A blind multi-signature scheme can be described by following five algorithms: 
setup, blind, sign, unblind, and verification. 
A third trust party (TTP) is used, and the process is detailed as follows. 


a. 


Setup: Create public arguments based on the GF(p) field and open the argument (p,q,G,P) to the 
public. Each user in the group can use their private key as identification and calculate the value 
of the public key. 

Blind: Users chose two random arguments and combine them with the hash of message M to 
make the content of M blind. The first part of the signature value (r) is simultaneously blinded in 
this part and sent to the signing group. 

Sign: Each user in the signing group calculates their own signature, and the TTP calculates the 
signature of the group and sends it back to the requesting user. 

Unblind: The requesting user unblinds the signature. The result is the set (r,s), which is the blind 
multi-signature on message M. 

Verify: the checking user verifies the signature, which is only accepted if the verification process 
is satisfied; otherwise, the signature is not accepted. 


The digital signature parameters are: 


a. 


g. 


p is a large prime number, which composes the field GF(p) of EC. 


b. EC is determined by the description in Part 2. 
c. 
d. qis a prime number that indicates the number of EC point groups and is determined as follows: 


integer m is an elliptic curve EC points group order: m = nq, n belongs to Z, n21. 


Piai <q<2 or 2708 <q<2”. 


. Gis a point that does not coincide with the origin O of EC and has the coordinate (x,, Yg), which 


satisfies the following condition: q x G = O 
H(M) is the value of the hash function with an /-bit length satisfies the following condition: 


94 < q < 96 


508 512 
If then/=256; If? <%<2  then/=512. 


d is a private key of user (O<d< q). 


2.1. GOST R 34-10-2012 Standard [3] 


a. 


b. 


Setup: Calculate the public key point as follows: P = d x G. 

The signing party choses a random number k that satisfies (0< k < q) and calculates C = k x G. 
Sign: Calculate the hash value of message M. Determine the first part of signature r as follows: 
r = Xo modq, where x, is the abscissa of point C. If r = 0, then another value of k needs to be 


chosen. Calculate e = H(M)modqą. Calculate the second part of the  signatureas 
s =(rd+ke)mod g. If s = 0, then choose another value of k. 


The output of the algorithm is the set (r,s), which is set as the digital signature on message M. 
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c. Verify: Calculate C’= (se! mod q)xG - (re! mod q) x P; r' = xe mod gq. Compare r' with r. If r'= 

r, then the digital signature is accepted; otherwise, the digital signature is not accepted. 
2.2. EC-Schnorr scheme [14] 

a. Setup: Calculate the public key point: P = d x G. The signing party choses a random number k 
that satisfies (0<k<q) and calculates C = k x G. 

b. Sign: Calculate the first part of the signature. Determine the first part of signature as 
r=H(M,x,)modq. Where xç is the abscissa of point C. If r = 0, then another value of k is 
chosen. Calculate s = (k —rd ) mod q. If s =0, then the process is started again. 


The output of the algorithm is the set (r,s), which is used as the digital signature on message M. 
c. Verify: Calculate C’=sxG+rxP and r’=H(M,x,.). Compare r' with r. If r' = r, then the 
digital signature is accepted; otherwise, the digital signature is not accepted. 


2.3. Blind Multi-signature 

Assume that user U asks the entire group S who has the authority to include n signers to sign 
document M; however, this user does not want this authorized group to know the content of M. First, this user 
blinds the document M, which becomes document M’. Then, M” is sent to the authorized signing group. This 
group signs M’ and sends it back to the requesting user. Then, the user unblinds M’ to M and checks the 
received signature. If the signature is valid, then the user has a valid signature on document M. 


2.4. Random Oracle Model 

In 1993, Bellare and Rogaway [15] generalized a model that allowed for the security of different 
coding schemes. A blind digital signature scheme is considered safe when its characteristics of blindness and 
anti-forgery can be ensured in a random predictive model. 

Definition 3: (Blindness). With all polynomial time algorithms of attacker A acting as the signer, the 
probability of success of the experiment below is a negligibly small function. 

There are two trusted users Uo, Uj, which join the blind multi-signature signature scheme with A on 
the message M,,,M,, and the output the signature s,_,,s,corresponding to b € {0,1}is randomly selected. 


(M,_,.M,,s 


1-b? 
S,) is then sent to A, and the output is b' €e {0,1}. For all A, Uo, U;, when any constant prime 
1 


c 


1-59 


1-b? 


number p is large enough, the probability of success of the experiment is negligible: | Pr[b =b']- : |< 


Definition 4: (Assumed ECDLP Problem) Taking a set of points P that have a field Z, and 
elementary G sod xG € P, where d is a random number chosen in the field Zo the assumed ECDLP of P is 
the calculated value of d. (e,t) - is assumed in the point P group if it can solve within time ż the difficult 
ECDLP of group P with the smallest probability £. 


3. PROPOSED BLIND MULTISIGNATURE SCHEMES 
3.1. BMS based on the GOST R34-10-2012 standard 
a. Setup: For each signer with the authority to sign S, calculate the value of the public key and send 


it to the TTP to calculate the public key value: P =d,xG and P =P +P, +...+ P, = yd, xG. 
i=l 
Each signer with the authority to sign selects the random numbers k,(k, € Z,) and calculates C,, 
which is sent to the TTP to calculate C with C,=k,xG, where i = 1,2... n and 
C SY -Fk xG. S sends C to U. 
b. Blind: U sen two random numbers, a, f €{1,2,...,g-1}, and the following variants are 


calculated. 
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Variant 1 Variant 2 
h=H(M); h=H(M); 
e = hmodq; e=hmodq; 
e =aemodgq; e = Bemodg; 
C= BxC+axG; C =(a'modq)xC+P+G; 
r =x, modq; r =X-modq; 


F =(rBa) mod. r =ap(r+e)modq. 


U sends F and @ to the group with the authority to sign S. 
c. Sign blind: Each signer calculates s,, sends it to the TTP to calculate 5, and then sends 5S to the 


user as follows: s; = k,e +d,r modq; s = Day mod q. 
i=l 
d. Unblind: The user calculates s. A pair (r, s) is the blind multi-signature of a signer collective for 
message M. 


Variant 1 Variant 2 


s = (BaS +ae) mod q. s=(f'a's +e)modg. 


e. Verify: Calculate the following: C’=(se'modq)xG-(re'modq)xP and r'=x,,modq. 


Compare r' andr. If r’=r, then the signature will be accepted. 


Proof: 


s; xG =[(k,e +d,r)modq]xG; 
C, =k, xG =(s,e" mod q)xG- (d,re' mod q) x G; 


v C= SC, =2'S (5, mod g)xG-7"> (d, modq)xG; 
i=l i=l i=l 
C = (se mod q)x G - (re! mod q) x P; 
7 =(rf'a) mod q®@r =F fa" mod q; 
C' = (se mod q) xG - (re! mod q) x P; 
C'=[(ae+ Bsa )e' mod q]xG -[(F Bae) mod q] x P; 
C' = Bl(se' mod q)xG-(re" mod g)x P]+ (œ mod q) xG; 
C'=8xC+axG; 
r'=r. 
s,xG=[(k,e+d,7)modq]xG; 
C, =k, xG =(s,e"' modq)xG-(d,re' modq)xG; 
v C=C =7 X (5, modg)xG-7" $ (d, modgxG: 


il 
C = (5e mod q)xG - (re mod q) x P; 

T = aB(r+e)modq®r =(a' B`F - e)mod q; 

C' = (se mod q) x G - (re mod q) x P; 

C'=[(a' B's + ee" mod q]x G-[(a' BF - e)e" mod q]x P; 
C'=[(a'B'se'! +1)modq]xG-[(a' 8 re" -1)mod q]x P]; 
C'= a'modqxC+P+Ge=C; 


r=r. 
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3.2. BMS based on the EC-Schnorr signature scheme 
a. Setup: For each signer with the authority to sign S, calculate the value of the public key and send 


it to the TTP to calculate the public key value: P=d,xG, where i = 1, 2,....n and 


P=P+P,+..4P, =) d,xG. 
i=l 


Each signer with signing authority selects the random numbers k,(k, € Z,), calculates C, and 


then sends it to the TTP to calculate C as follows: C,=k,xG, where i = 1, 2,....n and 


C= XC, = Vk, xG. The authorized signers then send C to U. 
i=l i=l 


b. Blind: U selects two random numbers «œ, €{1,2,...,.g-1}, and the variants are calculated: 


Variant 1 Variant 2 
C=C+axG+ xP; C=axC+ BxG; 
r= H(M,x,)modq; r=H(M,x,)modq; 
r =(r— p)modq. F =a (r-—ßp)modq. 


The users then sends 7 to each of the signers. 
c. Sign blind: Each signer calculates s,, sends it to TTP to calculate 5 and then sends S to the user 


as follows: s, =k, -—d,r modq; 5 = $s, mod q. 
i=l 


d. Unblind: The following variants are calculated. 


Variant 1 Variant 
2 
s=(s +a@)modq. s = &s modq. 


The pair (r, s) is the blind multi-signature of the signer collective on message M. 
e. Verify: Calculate C'=sxG—rxP;r'=H(M,x,,). Ifr' = r, then the signature will be accepted. 


Proof: 


C'=sxG-rxP,; 
C'=(S+a)xG+(F + B)xP; 
y C'=(axG+ BxP+) (k,-7x,)xG+F> x, xG); 
i=l i=l 


C'=C+axG+ßxP,; 


r’=H(M,x..)=H(M,x,)=r. 


C'=sxG+rxP; 

C'=asxG+(ra+t+ B)xP; 

C'=a)\(k,-x7)xGt+ar)\x,xG+ BxP; 
i=l i=l 


C'=axC+ BxG; 
r'=H(M,x..)=H(M,x,)=r. 
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4. ANALYSIS OF THE PROPOSED BMS SECURITY 
4.1. Security Analysis 

A security blind multi-signature scheme is determined by the following two characteristics: 
blindness and unforgeability. 

Theorem 1. (Blindness) The proposed blind multi-signature schemes are blind. 

Proof [16], [17]: Definition 3 is used for the proof. 

First, the signature pair (M,r,s) €{(M,,1%,5,).(M,.7,5,)} is considered one of the two signature 
sets for A (A acts as the signatory), and (@,7,5) is the data stored in the release scheme of A. Two random 
parameters a, p occur and link (@,7,5) to (M,r,s). 

r always has a relation that is constant, regardless of the blinding factors a, 6. Therefore, 
(M,r,s)€{(M,,1%,5,),(M,,7,,5,)} are selected with the stored data in the scheme A. In (7,5), the (a, p) pair 


always occurs and is satisfied. The largest probability of choosing the right (b' =b) in the release signature 


0? 


' 1 1, 1 
set (M,r,s) €{(M),%,5)),M,.7,5,) } is : . In addition, Pr[b'=b]= 7 therefore |Pr[b' = ip k= 
P 


satisfies definition 3 and the schemes are unconditionally blind. 
From the schema description, 


@ = ae modq;F =(rf'a)modq; 
s= (Ba's + &e) mod q; 
Varianti > @=ee';B=(s-e)ee's"; 


7 =(rß'aæ)modq; 
Based on the GOST 


wore: Se 
34-10-2012 standard >r=Fr(s-e)s modą. 


e = pe mod p;r = Pa(r +e)modq; 


s=(f'a's +e)modq; ß =ee"'; 


Variant 2 ea 
a=(s—e) @ es, 
F = Ba(r+e)modq;r =7r(s—e)s' —e. 
r =(r- B)modgq;s =(s +a@)modq; 
a=s-s;P=(r-r); 
Variant 1 C=C+axG+ BxP; 
> C=CH+(s-5)xG+(r-F)xP; 
Based on the EC- r=H(M,x,). 
Schnorr signature A 2 = 
scheme r=a (r—f)modq;s =as modq; 


a=ss';B=r—Tss'; 

Variant2 C=axC+BxG; 
C=s5s 'xC+(r-rss ')xG mod p; 
r=h(M,x,)modq. 


Theorem 2. [16] The proposed blind multi-signature schemes are (é,t,q,,9,,.g,) in the ROM 


(4 *9s))q_1) 1 é;t'=1+O0(q, +q,)E and 


q dn 
(4n-4.>4,) are the number of extract queries, sign queries and hashing queries, respectively; and E is the 


assuming that (€',t')- DLP holds in Z,, where: £' = (1 dn 


time for a scalar calculation operation. 

Proof: Assuming that a forger A exists, algorithm B is constructed, and it employs A to solve a 
discrete logarithm problem. B is considered a nucleus group G in GF(p) with the element G and a prime q, 
and point Q is on the elliptic curve. B is asked to find xeZ, such that Q=xxG. B can be solved as 


follows: B chooses the hash function value h = H e {0,17 > Z, and then sends the public parameters (p, 


G, Q, e) to A and B selects two random parameters (k‘,d’) to calculate the following 
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; ; 7 
Based on the Variant 1 C*=k'xQ+d'xG. 


GOST R34-10-2012 standard Variant 2 C*=k"! x Q+G+P. 
Based on the EC-Schnorr Variant 1 C*=Q+d'xG+k'x P". 
signature scheme Variant 2 C*=k'xQ+d'xG. 


d' is defined as the private key (secret) of the signer, k’ is a value that is randomly selected and 
(k',d',C*) are the outputs. 


A queries the signing Oracle for message M and the identity d'. B checks whether d' has been 
previously queried for the ROM. If yes, then sets are retrieved from the table, and these values are used to 
sign message M according to the signing phase that was described in the scheme. The signature (M,7’,5’) is 


output. If d' has not been queried by the extraction Oracle, then B executes the simulation of the extraction 
Oracle and uses the corresponding secret key to sign message M. 


Adversary A outputs the forged signature s; =(e,7’,5,) for the message M with the secret key d'. B 
retains (e, r’) and in return asks A to re-sign the message to obtain s = (e,r, 53). 
Based on the GOST R 34-10-2012 standard 


We have: C* = (se' mod q) x G - (re mod q) x P; 
with P=dxG. 

Variant 1 k'xQ+d'xG = (se mod q) x G- (re mod q) x P; 
k'xxGtd'xG= se mod q) x G - (re mod q)d' x G; 
s, =e(k'x+d')+rd’. 
We have: C* = (se mod q) x G -(re" mod q) x P; 
with: P =d'xG. 

Variant 2 k''x0+G+P =(se' modq)xG - (re mod q)x P; 
xk’! +d'+1= sh" -rh'd', 
s; =h(xk"' +d'+1)+rd'. 


Based on the EC-Schnorr signature scheme 


We have: C*=sxG+rxP. 

Variant 1 Q+k'd'xG+d'xG =s xG+rx P; 
xxG+k'd'xG+d'xG =s,xGtrd'xG; 
s = x+d'k'-rd'+d'. 
We have: C*=sxGtrx P. 

Varint2  k'xQ+d'xG=sxG+rx P; 
xk'+d'=s,+rd’; 


5; = xk'+d'—rd'. 


The output is the linear equation x, which solves the discrete logarithm problems. 


4.2. Probability Analysis 
A probability analysis is performed, and the results indicate that the right hash function value is 
Dn 
T= 


+ 
— and is completed in (q, +q,) iterations. Thus, (1— fryta > 1-44. +45) 
q q q 


. B can determine a strict 


1 
point to reselect the hash function value with a probability of —. In the ROM, the ideal probability value 
qh 
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; n l : f ia 
that does not equate to signature s is —. ¢'was obtained with a successful probability as 
q 


+ 1, 1 
g'= TE Fa) ty ty The time complexity of algorithm B based on the exponentiation function 
q 


q dn 
performed in the extract and sign phase is equal to t’=t+O(q, +4q,)E. 


4.3. Performance Analysis 
The efficiency of two proposed BMS models with two other schemes [6, 18] is determined with the 
assumption that these schemes must be calculated with the same security parameters used for Z, and include 


“n” member signers. 
Notations: 


T, time cost of a hash operation in Z,. 
T, time cost of a scalar multiplication in Z,. 
T, 


inv 


time cost of an inverse operation in Z,. 

T,, time cost of a modular multiplication in Z,. 

T, time cost of a extra points in Z,. 

The computational costs for the two signed regression schemes is as follows: According to [4], 


T, =T,,3T, = 297, ;T,,, ~ 2407; T, ~0,12T,. 


m?~s m? ~ inv 


Table 1. Performance comparison of the different schemes 


BMS based on the GOST BMS based on the EC-Schnorr [6] [4] 
R34.10-2012 standard signature scheme 
Variant 1 Variant 2 Variant 1 Variant 2 
Setup 59nT, 59nT,, 59nT,, 59nT,, 59nT,, 59nT,, 
Blind 3027, 2457, 58T, 245T, 3327, 245T, 
Blind sign 2nT,, 2nT,, nT, nT, 2nT,, 2nT,, 
Unblind 2437, 4827, Negligible T, 4837, T, 
Verify 4827, 4827, 58T, 58T, 4827, 88T, 
10277, 11697, 1167, 3047, 11977, 3347, 
Tol 46InT, aT, AE +60nT, 46InT, +6 InT, 


The following results are based on the comparison Table 1. We realized that the time cost of the 
proposed blind multi-signature scheme based on the GOST R34.10-2012 standard according to Variant 1 and 
2 has a higher computational complexity than the proposed blind digital signature scheme based on the EC- 
Schnorr digital signature scheme. 

The time cost of the proposed scheme based on the GOST R34.10-2012 standard has lower 
computational efficiency than another scheme [6], and the proposed scheme based on the EC-Schnorr 
scheme has lower computational efficiency than the other scheme [6], [4]. 

When comparing the performance on a per-standard digital signature scheme, the performance of 
the proposed blind multi-signature has better computational efficiency. 


5. CONCLUSION 

In this paper, we presented options for building blind multi-signature signature schemes based on 
the GOST R34.10-2012 digital signature standard and the EC-Schnorr digital signature scheme. The blind 
multi-signature signature schemes were developed that inherits the security and the properties of digital 
signature standards in practice. The proofs of the proposed schemes were full blindness and unforgeability in 
the ROM. The results show that the proposed blind multi-signature signature schemes are safe and present 
high performance; therefore, they can be applied in practice. 


Int J Elec & Comp Eng, Vol. 8, No. 2, April 2018 : 1074 — 1083 


Int J Elec & Comp Eng ISSN: 2088-8708 O 1083 


REFERENCES 


[1] 
[2] 
[3] 
[4] 
[5] 
[6] 
[7] 
[8] 
[9] 
[10] 


[11] 


[12] 


[13] 


[14] 
[15] 
[16] 
[17] 


[18] 


Chaum D, “Blind signatures for untraceable payments”, Advances in Cryptology, Crypto’82, Plenum (1983) 
199-203 

N. Koblitz (1987), “Elliptic curve cryptosystems”, Mathematics of Computation, Vol.48, pp.203-209. 

GOST R 34.10-2012, “Digital Signature Algorithm draft-dolmatov-gost34102012-00, V. Dolmatov, Ed, (2013). 
Popescu C, “Blind Signature and BMS Using Elliptic Curve”s. Studia univ. “babes —bolyai”, Informatica. (1999) 
43-49 

S. S. Chow et al. (2005), “Two Improved Partially Blind Signature Schemes from Bilinear Pairings”, Information 
Security and Privacy, 3547, pp. 316-328. 

Moldovyan, N.A., “Blind Signature Protocols from Digital Signature Standards”, International Journal of Network 
Security (2011) 22-30 

T. A. T. Nguyen and T. K. Dang (2013), “Enhanced security in internet voting protocol using blind signature and 
dynamic ballots”, Electronic Commerce Research, 13. 

Swati Verma, Birendra Kumar Sharmal (2012), “New Proxy Blind Multi Signature based on Integer Factorization 
and Discrete-Logarithm Problems”, http://journal.portalgaruda.org/index.php/EEI, Vol.1, pp 185~190. 

S. Panda et al. (2013), “An Application of time stamped proxy blind signature in e-voting”, International Journal 
on Computer Science and Engineering, 5 (6), pp. 547-552. 

Hua Sun, Yanqiang Ge (2014), “New Certificateless Blind Ring Signature Scheme”, TELKOMNIKA 
(Telecommunication Computing Electronics and Control), Vol.12, No.1, pp 778-783 

Shilbayeh, N.F., Al-Saidi, R.A., Alsswey, A.H., “Evaluation and Analysis of the Secure E-Voting Authentication 
Preparation Scheme”, International Journal of Computer, Electrical, Automation, Control and Information 
Engineering, (2016) 560-568. 

Minh, H., Hai, N., Moldovyan, N., Giang, T., “New Blind Signature Protocols Based on a New Hard Problem”, 
The International Arab Journal of Information Technology, Vol. 14, No.3, May 2017. 

Salome James, T. Gowri, G.V. Ramesh Babu, P. Vasudeva Reddy (2017), “Identity-Based Blind Signature Scheme 
with Message Recovery”, International Journal of Electrical and Computer Engineering (IJECE), Vol. 7, No. 5, 
pp2674-2682. 

Darrel Hankerson, Alfred Meneze, Scott Vanstone (2004), Guide to EllipticCurve Cryptography, Springer, 
NewYork, USA. 

Bellare, M., Rogaway, P., “Random oracles are practical: a paradigm for designing efficient protocols”, 
Proceedings of the 1st ACM conference on Computer and communications security. (1993) 62-73 

Liu, J.K., Baek, J, Zhou, J., Yang, Y., Wong, J.W., “Efficient online/offline identity-based signature for wireless 
sensor network”, International Journal of Information Security, (2010) 287-296 

Chun-I Fan, Wei-Zhe Sun, Vincent Shi-Ming Huang (2010), “Provably secure randomized blind signature scheme 
based on bilinear pairing”. 

D. Schroder (2010), On the Complexity of Blind Signatures, Technischen Universitat Darmstadt genehmigte. 


New Blind Muti-signature Schemes Based on ECDLP (Duc Nguyen Tan) 


